On this note, there's a small variation on this idea that we've experimented with at Jane Street that I think is worth mentioning. When people do this kind of thing, they usually have two phantom tags, "immutable" and "mutable", but, there is another natural one to add: "readonly".
A mutable value is, as one would expect, a value that can be modified; and an immutable value is one that can not be modified. A readonly value is one that can not be modified, but that might change nonetheless because somewhere else in the program there is a mutable handle to the same underlying value. You implement this by making the interface for immutable and readonly values identical, except that a readonly value can be created from a mutable value without copying. Mutable and immutable are typically the most important types of access control to implement, but readonly can be useful in special cases, where you have a value that you really want to mutate, but that you want to control where in the program the mutation can happen.
There's one extra tradeoff worth mentioning with using phantom types for controlling mutability, which is that values made immutable in this way are not quite as good as values that are immutable at the lowest level. The reason is that ordinary immutable values are understood by the type system as such, and this goes into the compiler's understanding of the value restriction and variance. This means there are cases where, say, a phantom-immutable list won't work, but an ordinary immutable list will.
(For those interested in a short and elementary tutorial on how to implement access control with phantom types, look here:
http://ocaml.janestreet.com/?q=node/11)
y